<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  
  <title>tcpdump及tshark 使用 | YouN 科技温度</title>
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
  
  <meta name="keywords" content="LinuxNetTcpdump" />
  
  
  
  
  <meta name="description" content="译自 A tcpdump Tutorial and Primer with Examples 有所增删，可以通过 man tcpdump 获取更详细信息 只要和网络沾边，都可以使用tcpdump来排查问题。 1  基础1.1 常用选项 -i any ：监听任意网络设备 -i eth0 ：监听eth0 -D ：列出所有可监听设备 -n ：不要把IP解析为主机名（显示IP） -nn ：不要把IP和PO">
<meta property="og:type" content="article">
<meta property="og:title" content="tcpdump及tshark 使用">
<meta property="og:url" content="http://this4u.cn/2019/09/23/tcpdump/index.html">
<meta property="og:site_name" content="YouN 科技温度">
<meta property="og:description" content="译自 A tcpdump Tutorial and Primer with Examples 有所增删，可以通过 man tcpdump 获取更详细信息 只要和网络沾边，都可以使用tcpdump来排查问题。 1  基础1.1 常用选项 -i any ：监听任意网络设备 -i eth0 ：监听eth0 -D ：列出所有可监听设备 -n ：不要把IP解析为主机名（显示IP） -nn ：不要把IP和PO">
<meta property="og:locale" content="zh_CN">
<meta property="article:published_time" content="2019-09-23T11:19:37.000Z">
<meta property="article:modified_time" content="2023-04-13T05:58:10.715Z">
<meta property="article:author" content="Timmy">
<meta property="article:tag" content="Linux">
<meta property="article:tag" content="Net">
<meta property="article:tag" content="Tcpdump">
<meta name="twitter:card" content="summary">
  
    <link rel="alternate" href="/atom.xml" title="YouN 科技温度" type="application/atom+xml">
  
  <link rel="icon" href="/css/images/favicon.ico">
  
    <link href="//fonts.googleapis.com/css?family=Source+Code+Pro" rel="stylesheet" type="text/css">
  
  <link href="https://fonts.googleapis.com/css?family=Open+Sans|Montserrat:700" rel="stylesheet" type="text/css">
  <link href="https://fonts.googleapis.com/css?family=Roboto:400,300,300italic,400italic" rel="stylesheet" type="text/css">
  <link href="//cdn.bootcss.com/font-awesome/4.6.3/css/font-awesome.min.css" rel="stylesheet">
  <style type="text/css">
    @font-face{font-family:futura-pt;src:url(https://use.typekit.net/af/9749f0/00000000000000000001008f/27/l?subset_id=2&fvd=n5) format("woff2");font-weight:500;font-style:normal;}
    @font-face{font-family:futura-pt;src:url(https://use.typekit.net/af/90cf9f/000000000000000000010091/27/l?subset_id=2&fvd=n7) format("woff2");font-weight:500;font-style:normal;}
    @font-face{font-family:futura-pt;src:url(https://use.typekit.net/af/8a5494/000000000000000000013365/27/l?subset_id=2&fvd=n4) format("woff2");font-weight:lighter;font-style:normal;}
    @font-face{font-family:futura-pt;src:url(https://use.typekit.net/af/d337d8/000000000000000000010095/27/l?subset_id=2&fvd=i4) format("woff2");font-weight:400;font-style:italic;}</style>
    
  <link rel="stylesheet" id="athemes-headings-fonts-css" href="//fonts.googleapis.com/css?family=Yanone+Kaffeesatz%3A200%2C300%2C400%2C700&amp;ver=4.6.1" type="text/css" media="all">

  <link rel="stylesheet" id="athemes-headings-fonts-css" href="//fonts.googleapis.com/css?family=Oswald%3A300%2C400%2C700&amp;ver=4.6.1" type="text/css" media="all">
  
<link rel="stylesheet" href="/css/style.css">


  
<script src="/js/jquery-3.1.1.min.js"></script>


  <!-- Bootstrap core CSS -->
  <link rel="stylesheet" href="/css/bootstrap.css" >
  <link rel="stylesheet" href="/css/fashion.css" >
  <link rel="stylesheet" href="/css/glyphs.css" >

<meta name="generator" content="Hexo 6.3.0"></head>



  <body data-spy="scroll" data-target="#toc" data-offset="50">


  


<header id="allheader" class="site-header" role="banner" 
   >
  <div class="clearfix container">
      <div class="site-branding">

          <h1 class="site-title">
            
              <a href="/" rel="home" >
                <img style="margin-bottom: 2px;"  width="126px" height="60px" alt="Hike News" src=" /css/images/youu.jpg">
              </a>
            
          </h1>
          
          
            
          <nav id="main-navigation" class="main-navigation" role="navigation">
            <a class="nav-open">Menu</a>
            <a class="nav-close">Close</a>

            <div class="clearfix sf-menu">
              <ul id="main-nav" class="menu sf-js-enabled sf-arrows"  style="touch-action: pan-y;">
                    
                      <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-home menu-item-1663" linktext="/"> <a class="" href="/">首页</a> </li>
                    
                      <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-home menu-item-1663" linktext="archives"> <a class="" href="/archives">归档</a> </li>
                    
                      <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-home menu-item-1663" linktext="categories"> <a class="" href="/categories">分类</a> </li>
                    
                      <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-home menu-item-1663" linktext="tags"> <a class="" href="/tags">标签</a> </li>
                    
                      <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-home menu-item-1663" linktext="about"> <a class="" href="/about">关于</a> </li>
                    
              </ul>
            </div>
          </nav>

      </div>
  </div>
</header>


  <div id="container">
    <div id="wrap">
            
      <div id="content" class="outer">
        
          <section id="main" style="float:none;"><article id="post-tcpdump" style="width: 66%; float:left;" class="article article-type-post" itemscope itemprop="blogPost" >
  <div id="articleInner" class="clearfix post-1016 post type-post status-publish format-standard has-post-thumbnail hentry category-template-2 category-uncategorized tag-codex tag-edge-case tag-featured-image tag-image tag-template">
    
    
      <header class="article-header">
        
  
    <h1 class="thumb" class="article-title" itemprop="name">
      tcpdump及tshark 使用
    </h1>
  

      </header>
    
    <div class="article-meta">
      
	<a href="/2019/09/23/tcpdump/" class="article-date">
	  <time datetime="2019-09-23T11:19:37.000Z" itemprop="datePublished">九月 23, 2019</time>
	</a>

       
      
	<span id="busuanzi_container_page_pv">
	  本文总阅读量<span id="busuanzi_value_page_pv"></span>次
	</span>

    </div>
    <div class="article-entry" itemprop="articleBody">
      
        <p>译自 <a target="_blank" rel="noopener" href="https://danielmiessler.com/study/tcpdump/">A tcpdump Tutorial and Primer with Examples</a> 有所增删，可以通过 <code>man tcpdump</code> 获取更详细信息</p>
<p>只要和网络沾边，都可以使用tcpdump来排查问题。</p>
<h2 id="1-基础"><a href="#1-基础" class="headerlink" title="1  基础"></a>1  基础</h2><h3 id="1-1-常用选项"><a href="#1-1-常用选项" class="headerlink" title="1.1 常用选项"></a>1.1 常用选项</h3><ul>
<li><code>-i any</code> ：监听任意网络设备</li>
<li><code>-i eth0</code> ：监听eth0</li>
<li><code>-D</code> ：列出所有可监听设备</li>
<li><code>-n</code> ：不要把IP解析为主机名（显示IP）</li>
<li><code>-nn</code> ：不要把IP和PORT解析为主机名和服务（显示IP和端口）</li>
<li><code>-q</code> ：显示更少信息</li>
<li><code>-tttt</code> ：更具有可读性的时间格式</li>
<li><code>-X</code> ：以hex和ascii格式显示包内容</li>
<li><code>-XX</code> ：同 <code>-X</code> , 同时包含以太网协议头</li>
<li><code>-v, -vv, -vvv</code> ：显示更多信息</li>
<li><code>-c x</code> ：最多抓取x个包，然后退出</li>
<li><code>-A</code> ：以ASCII格式打印每个包（最小化link level的头）,适合抓web页面</li>
<li><code>-s</code> ：Define the snaplength (size) of the capture in bytes. 使用 <code>-s0</code> 获取全部</li>
<li><code>-w file</code> ：把结果输出到文件file</li>
<li><code>-S</code> ：Print absolute sequence numbers.</li>
</ul>
<h3 id="1-2-表达式"><a href="#1-2-表达式" class="headerlink" title="1.2 表达式"></a>1.2 表达式</h3><p>表达式用于过滤抓到的包，有三类表达式</p>
<ul>
<li>类型 <code>host</code> <code>net</code> <code>port</code></li>
<li>数据流向 <code>src</code> <code>dst</code></li>
<li>协议 <code>tcp</code> <code>udp</code> <code>icmp</code> 等</li>
</ul>
<h2 id="2-例子"><a href="#2-例子" class="headerlink" title="2 例子"></a>2 例子</h2><h3 id="2-1-获取所有流量"><a href="#2-1-获取所有流量" class="headerlink" title="2.1 获取所有流量"></a>2.1 获取所有流量</h3><p><code>tcpdump -i any</code> 当机器有多个网卡，不确定流量走哪个时，使用这个选项</p>
<h3 id="2-2-获取eth0上的流量"><a href="#2-2-获取eth0上的流量" class="headerlink" title="2.2 获取eth0上的流量"></a>2.2 获取eth0上的流量</h3><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump -i eth0</span><br></pre></td></tr></table></figure>

<h3 id="2-3-查看原始流量"><a href="#2-3-查看原始流量" class="headerlink" title="2.3 查看原始流量"></a>2.3 查看原始流量</h3><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump -nn -tttt -vv -S -c 10</span><br></pre></td></tr></table></figure>

<h3 id="2-4-查看指定host和port"><a href="#2-4-查看指定host和port" class="headerlink" title="2.4 查看指定host和port"></a>2.4 查看指定host和port</h3><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump port 80 and host 10.129.204.105</span><br></pre></td></tr></table></figure>

<h3 id="2-5-以hex和ascii查看包内容"><a href="#2-5-以hex和ascii查看包内容" class="headerlink" title="2.5 以hex和ascii查看包内容"></a>2.5 以hex和ascii查看包内容</h3><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump -nn -v -X -s0 -c 1 tcp</span><br></pre></td></tr></table></figure>

<h3 id="2-6-指定数据的方向"><a href="#2-6-指定数据的方向" class="headerlink" title="2.6 指定数据的方向"></a>2.6 指定数据的方向</h3><p>获取所有目标端口是80的流量 <code>tcpdump -i any -nn -s0 -c 10 -A tcp and dst port 80</code></p>
<p>获取所有80端口的流量 <code>tcpdump -i any -nn -s0 -c 10 -A tcp and port 80</code></p>
<h3 id="2-7-获取指定协议的流量"><a href="#2-7-获取指定协议的流量" class="headerlink" title="2.7 获取指定协议的流量"></a>2.7 获取指定协议的流量</h3><p>获取vrrp协议的流量，用于调试keepalive <code>tcpdump vrrp</code></p>
<h3 id="2-8-获取ipv6的流量"><a href="#2-8-获取ipv6的流量" class="headerlink" title="2.8 获取ipv6的流量"></a>2.8 获取ipv6的流量</h3><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump ip6</span><br></pre></td></tr></table></figure>

<h3 id="2-9-获取某个端口范围的流量"><a href="#2-9-获取某个端口范围的流量" class="headerlink" title="2.9 获取某个端口范围的流量"></a>2.9 获取某个端口范围的流量</h3><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump -nn portrange 21-23 and src host 10.136.110.179</span><br></pre></td></tr></table></figure>

<h3 id="2-10-基于包大小过滤"><a href="#2-10-基于包大小过滤" class="headerlink" title="2.10 基于包大小过滤"></a>2.10 基于包大小过滤</h3><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">tcpdump -i any -nn port 80 and less 80</span><br><span class="line">tcpdump -i any -nn port 80 and greater 80</span><br></pre></td></tr></table></figure>

<h2 id="3-进阶"><a href="#3-进阶" class="headerlink" title="3 进阶"></a>3 进阶</h2><h3 id="3-1-表达式组合"><a href="#3-1-表达式组合" class="headerlink" title="3.1 表达式组合"></a>3.1 表达式组合</h3><p>通过 <code>and 或 &amp;&amp;</code> <code>or 或 ||</code> <code>not 或 ！</code> 可以组合表达式</p>
<p>表达式的结合律有点奇怪，需要自己体会，例如： 监听80或8080并且来自10.129.204.105的请求 <code>tcpdump -i any -nn -vv port 80 or 8080 and src host 10.129.204.105</code> <code>tcpdump -i any -nn -vv port 80 or port 8080 and src host 10.129.204.105</code></p>
<p>监听80并且来自10.129.204.105的请求或监听8080的请求（没有来源IP限制） <code>tcpdump -i any -nn -vv port 80 and src host 10.129.204.105 or port 8080</code></p>
<p>为了避免这些微妙的差别，可以使用 <code>()</code> ，注意这里的单引号 <code>tcpdump -i any -nn -vv &#39;(port 80 or port 8080)&#39; and src host 10.129.204.105</code></p>
<h3 id="3-2-指定源host和目标端口"><a href="#3-2-指定源host和目标端口" class="headerlink" title="3.2 指定源host和目标端口"></a>3.2 指定源host和目标端口</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump -i any -nn -vv port 80 and src host 10.129.204.105</span><br></pre></td></tr></table></figure>

<h3 id="3-3-目标是某台机器的所有非tcp请求"><a href="#3-3-目标是某台机器的所有非tcp请求" class="headerlink" title="3.3 目标是某台机器的所有非tcp请求"></a>3.3 目标是某台机器的所有非tcp请求</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump -i any -nn dst host 10.136.110.179 and not tcp</span><br></pre></td></tr></table></figure>

<h3 id="3-4-来自某台机器的所有非22请求"><a href="#3-4-来自某台机器的所有非22请求" class="headerlink" title="3.4 来自某台机器的所有非22请求"></a>3.4 来自某台机器的所有非22请求</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump -i any -nn src host 10.129.204.105 and not dst port 22</span><br></pre></td></tr></table></figure>

<h3 id="3-5-获取tcp-flag"><a href="#3-5-获取tcp-flag" class="headerlink" title="3.5 获取tcp flag"></a>3.5 获取tcp flag</h3><p>先了解下TCP和IP协议头，虽然最后有0~40个可选bytes，这里没用到，可以先忽略它们。TCP头20bytes，其中tcp flags在第13个byte（下标为0） <code>|C|E|U|A|P|R|S|F|</code> 。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line">TCP</span><br><span class="line"> 0                            15                              31</span><br><span class="line">-----------------------------------------------------------------</span><br><span class="line">|          source port          |       destination port        |</span><br><span class="line">-----------------------------------------------------------------</span><br><span class="line">|                        sequence number                        |</span><br><span class="line">-----------------------------------------------------------------</span><br><span class="line">|                     acknowledgment number                     |</span><br><span class="line">-----------------------------------------------------------------</span><br><span class="line">|  HL   | rsvd  |C|E|U|A|P|R|S|F|        window size            |</span><br><span class="line">-----------------------------------------------------------------</span><br><span class="line">|         TCP checksum          |       urgent pointer          |</span><br><span class="line">-----------------------------------------------------------------</span><br><span class="line">|                 optional data 0~40 bytes                      |</span><br><span class="line">-----------------------------------------------------------------</span><br><span class="line"></span><br><span class="line"> |---------------|</span><br><span class="line"> |C|E|U|A|P|R|S|F|</span><br><span class="line"> |---------------|</span><br><span class="line"> |7   5   3     0|</span><br><span class="line"></span><br><span class="line">IP</span><br><span class="line">  0| 1| 2| 3| 4| 5| 6| 7| 8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31</span><br><span class="line">-----------------------------------------------------------------------------------------------</span><br><span class="line">| version   |    IHL    |      DSCP       | ECN |             total length                     </span><br><span class="line">-----------------------------------------------------------------------------------------------</span><br><span class="line">|             Identification                    | Flags  |       Fragment Offset               </span><br><span class="line">-----------------------------------------------------------------------------------------------</span><br><span class="line">|          TTL          |      Protocol         |               Header Checksum                </span><br><span class="line">-----------------------------------------------------------------------------------------------</span><br><span class="line">|                                         Source IP                                            </span><br><span class="line">-----------------------------------------------------------------------------------------------</span><br><span class="line">|                                        Destination IP                                        </span><br><span class="line">-----------------------------------------------------------------------------------------------</span><br></pre></td></tr></table></figure>

<h4 id="3-5-1-flag列表"><a href="#3-5-1-flag列表" class="headerlink" title="3.5.1 flag列表"></a>3.5.1 flag列表</h4><ul>
<li>URGENT (URG) <code>tcp[13] &amp; 32 != 0</code> 或 <code>tcp[tcpflags] == tcp-urg</code></li>
<li>ACKNOWLEDGE (ACK) <code>tcp[13] &amp; 16 != 0</code> 或 <code>tcp[tcpflags] == tcp-ack</code></li>
<li>PUSH (PSH) <code>tcp[13] &amp; 8 != 0</code> 或 <code>tcp[tcpflags] == tcp-psh</code></li>
<li>RESET (RST) <code>tcp[13] &amp; 4 != 0</code> 或 <code>tcp[tcpflags] == tcp-rst</code></li>
<li>SYNCHRONIZE (SYN) <code>tcp[13] &amp; 2 != 0</code> 或 <code>tcp[tcpflags] == tcp-syn</code></li>
<li>FINISH (FIN) <code>tcp[13] &amp; 1 != 0</code> 或 <code>tcp[tcpflags] == tcp-fin</code></li>
</ul>
<p>例如：获取所有SYN请求 <code>tcpdump -i any -nn -A -s0 &#39;tcp[13] &amp; 2 != 0&#39;</code></p>
<h4 id="3-5-2-获取tcp连接的开始和结束"><a href="#3-5-2-获取tcp连接的开始和结束" class="headerlink" title="3.5.2 获取tcp连接的开始和结束"></a>3.5.2 获取tcp连接的开始和结束</h4><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tcpdump -i any -nn -s0 -X &#x27;tcp[tcpflags] &amp; (tcp-syn|tcp-fin) != 0&#x27;</span><br></pre></td></tr></table></figure>

<h4 id="3-5-3-获取所有HTTP-GET请求"><a href="#3-5-3-获取所有HTTP-GET请求" class="headerlink" title="3.5.3 获取所有HTTP GET请求"></a>3.5.3 获取所有HTTP GET请求</h4><p><code>tcp[12]</code> 的高4位是TCP HEADER的长度（通常是20 bytes）,TCP之后是应用协议 <code>0x47455420</code> 是 GET 外加一个空格 <code>tcpdump -i any -nn -s0 -X &#39;tcp[((tcp[12] &amp; 0xf0) &gt;&gt; 2):4] = 0x47455420&#39;</code> 通常 <code>tcpdump -i any -nn -s0 -X &#39;tcp[20:4] = 0x47455420&#39;</code> 也是可以的</p>
<h4 id="3-5-4-获取所有SSH连接"><a href="#3-5-4-获取所有SSH连接" class="headerlink" title="3.5.4 获取所有SSH连接"></a>3.5.4 获取所有SSH连接</h4><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">0x5353482D` 是 `SSH-` `tcpdump -i any -nn -s0 -X &#x27;tcp[20:4] = 0x5353482D&#x27;</span><br></pre></td></tr></table></figure>

<h4 id="3-5-5-获取所有带数据的包"><a href="#3-5-5-获取所有带数据的包" class="headerlink" title="3.5.5 获取所有带数据的包"></a>3.5.5 获取所有带数据的包</h4><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">ip[2:2]` 整个IP包的长度 `(ip[0] &amp; 0xf) &lt;&lt;2` 是IP头的长度 `tcpdump -i any -nn -s0 -X port 80 and &#x27;(((ip[2:2] - ((ip[0]&amp;0xf)&lt;&lt;2)) - ((tcp[12]&amp;0xf0)&gt;&gt;2)) != 0)&#x27;</span><br></pre></td></tr></table></figure>
      
    </div>
    <footer class="entry-meta entry-footer">
      
      
  <span class="ico-tags"></span>
  <ul class="article-tag-list" itemprop="keywords"><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/Linux/" rel="tag">Linux</a></li><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/Net/" rel="tag">Net</a></li><li class="article-tag-list-item"><a class="article-tag-list-link" href="/tags/Tcpdump/" rel="tag">Tcpdump</a></li></ul>

      
        
	<div id="comment">
		<!-- 来必力City版安装代码 -->
		<div id="lv-container" data-id="city" data-uid="MTAyMC8yOTQ4MS82MDQ5">
		<script type="text/javascript">
		   (function(d, s) {
		       var j, e = d.getElementsByTagName(s)[0];

		       if (typeof LivereTower === 'function') { return; }

		       j = d.createElement(s);
		       j.src = 'https://cdn-city.livere.com/js/embed.dist.js';
		       j.async = true;

		       e.parentNode.insertBefore(j, e);
		   })(document, 'script');
		</script>
		<noscript>为正常使用来必力评论功能请激活JavaScript</noscript>
		</div>
		<!-- City版安装代码已完成 -->
	</div>



      
    </footer>
    <hr class="entry-footer-hr">
  </div>
  
    
<nav id="article-nav">
  
    <a href="/2019/09/23/tcpdump-tshark/" id="article-nav-newer" class="article-nav-link-wrap">
      <strong class="article-nav-caption">上一篇</strong>
      <div class="article-nav-title">
        
          tcpdump及tshark 使用
        
      </div>
    </a>
  
  
    <a href="/2019/09/18/git-commit-rewrite/" id="article-nav-older" class="article-nav-link-wrap">
      <strong class="article-nav-caption">下一篇</strong>
      <div class="article-nav-title">Git Commit Rewrite</div>
    </a>
  
</nav>

  
</article>

<!-- Table of Contents -->

  <aside id="sidebar">
    <div id="toc" class="toc-article">
    <strong class="toc-title">文章目录</strong>
    
      <ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#1-%E5%9F%BA%E7%A1%80"><span class="nav-number">1.</span> <span class="nav-text">1  基础</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1-1-%E5%B8%B8%E7%94%A8%E9%80%89%E9%A1%B9"><span class="nav-number">1.1.</span> <span class="nav-text">1.1 常用选项</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#1-2-%E8%A1%A8%E8%BE%BE%E5%BC%8F"><span class="nav-number">1.2.</span> <span class="nav-text">1.2 表达式</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#2-%E4%BE%8B%E5%AD%90"><span class="nav-number">2.</span> <span class="nav-text">2 例子</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#2-1-%E8%8E%B7%E5%8F%96%E6%89%80%E6%9C%89%E6%B5%81%E9%87%8F"><span class="nav-number">2.1.</span> <span class="nav-text">2.1 获取所有流量</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-2-%E8%8E%B7%E5%8F%96eth0%E4%B8%8A%E7%9A%84%E6%B5%81%E9%87%8F"><span class="nav-number">2.2.</span> <span class="nav-text">2.2 获取eth0上的流量</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-3-%E6%9F%A5%E7%9C%8B%E5%8E%9F%E5%A7%8B%E6%B5%81%E9%87%8F"><span class="nav-number">2.3.</span> <span class="nav-text">2.3 查看原始流量</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-4-%E6%9F%A5%E7%9C%8B%E6%8C%87%E5%AE%9Ahost%E5%92%8Cport"><span class="nav-number">2.4.</span> <span class="nav-text">2.4 查看指定host和port</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-5-%E4%BB%A5hex%E5%92%8Cascii%E6%9F%A5%E7%9C%8B%E5%8C%85%E5%86%85%E5%AE%B9"><span class="nav-number">2.5.</span> <span class="nav-text">2.5 以hex和ascii查看包内容</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-6-%E6%8C%87%E5%AE%9A%E6%95%B0%E6%8D%AE%E7%9A%84%E6%96%B9%E5%90%91"><span class="nav-number">2.6.</span> <span class="nav-text">2.6 指定数据的方向</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-7-%E8%8E%B7%E5%8F%96%E6%8C%87%E5%AE%9A%E5%8D%8F%E8%AE%AE%E7%9A%84%E6%B5%81%E9%87%8F"><span class="nav-number">2.7.</span> <span class="nav-text">2.7 获取指定协议的流量</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-8-%E8%8E%B7%E5%8F%96ipv6%E7%9A%84%E6%B5%81%E9%87%8F"><span class="nav-number">2.8.</span> <span class="nav-text">2.8 获取ipv6的流量</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-9-%E8%8E%B7%E5%8F%96%E6%9F%90%E4%B8%AA%E7%AB%AF%E5%8F%A3%E8%8C%83%E5%9B%B4%E7%9A%84%E6%B5%81%E9%87%8F"><span class="nav-number">2.9.</span> <span class="nav-text">2.9 获取某个端口范围的流量</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-10-%E5%9F%BA%E4%BA%8E%E5%8C%85%E5%A4%A7%E5%B0%8F%E8%BF%87%E6%BB%A4"><span class="nav-number">2.10.</span> <span class="nav-text">2.10 基于包大小过滤</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#3-%E8%BF%9B%E9%98%B6"><span class="nav-number">3.</span> <span class="nav-text">3 进阶</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#3-1-%E8%A1%A8%E8%BE%BE%E5%BC%8F%E7%BB%84%E5%90%88"><span class="nav-number">3.1.</span> <span class="nav-text">3.1 表达式组合</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3-2-%E6%8C%87%E5%AE%9A%E6%BA%90host%E5%92%8C%E7%9B%AE%E6%A0%87%E7%AB%AF%E5%8F%A3"><span class="nav-number">3.2.</span> <span class="nav-text">3.2 指定源host和目标端口</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3-3-%E7%9B%AE%E6%A0%87%E6%98%AF%E6%9F%90%E5%8F%B0%E6%9C%BA%E5%99%A8%E7%9A%84%E6%89%80%E6%9C%89%E9%9D%9Etcp%E8%AF%B7%E6%B1%82"><span class="nav-number">3.3.</span> <span class="nav-text">3.3 目标是某台机器的所有非tcp请求</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3-4-%E6%9D%A5%E8%87%AA%E6%9F%90%E5%8F%B0%E6%9C%BA%E5%99%A8%E7%9A%84%E6%89%80%E6%9C%89%E9%9D%9E22%E8%AF%B7%E6%B1%82"><span class="nav-number">3.4.</span> <span class="nav-text">3.4 来自某台机器的所有非22请求</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3-5-%E8%8E%B7%E5%8F%96tcp-flag"><span class="nav-number">3.5.</span> <span class="nav-text">3.5 获取tcp flag</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#3-5-1-flag%E5%88%97%E8%A1%A8"><span class="nav-number">3.5.1.</span> <span class="nav-text">3.5.1 flag列表</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#3-5-2-%E8%8E%B7%E5%8F%96tcp%E8%BF%9E%E6%8E%A5%E7%9A%84%E5%BC%80%E5%A7%8B%E5%92%8C%E7%BB%93%E6%9D%9F"><span class="nav-number">3.5.2.</span> <span class="nav-text">3.5.2 获取tcp连接的开始和结束</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#3-5-3-%E8%8E%B7%E5%8F%96%E6%89%80%E6%9C%89HTTP-GET%E8%AF%B7%E6%B1%82"><span class="nav-number">3.5.3.</span> <span class="nav-text">3.5.3 获取所有HTTP GET请求</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#3-5-4-%E8%8E%B7%E5%8F%96%E6%89%80%E6%9C%89SSH%E8%BF%9E%E6%8E%A5"><span class="nav-number">3.5.4.</span> <span class="nav-text">3.5.4 获取所有SSH连接</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#3-5-5-%E8%8E%B7%E5%8F%96%E6%89%80%E6%9C%89%E5%B8%A6%E6%95%B0%E6%8D%AE%E7%9A%84%E5%8C%85"><span class="nav-number">3.5.5.</span> <span class="nav-text">3.5.5 获取所有带数据的包</span></a></li></ol></li></ol></li></ol>
    
    </div>
  </aside>
</section>
        
      </div>

    </div>
    <!-- <nav id="mobile-nav">
  
    <a href="/" class="mobile-nav-link">Home</a>
  
    <a href="/archives" class="mobile-nav-link">Archives</a>
  
    <a href="/categories" class="mobile-nav-link">Categories</a>
  
    <a href="/tags" class="mobile-nav-link">Tags</a>
  
    <a href="/about" class="mobile-nav-link">About</a>
  
</nav> -->
    <footer id="footer" class="site-footer">
  

  <div class="clearfix container">
      <div class="site-info">
		<a href="https://beian.miit.gov.cn/" target="_blank">鄂ICP备2023005434号-1</a>  	
	        Copyright &copy; 2023 YouN 科技温度 All Rights Reserved.
        
            <span id="busuanzi_container_site_uv">
              本站访客数<span id="busuanzi_value_site_uv"></span>人次  
              本站总访问量<span id="busuanzi_value_site_pv"></span>次
            </span>
          
      </div>
      <div class="site-credit">
        Theme by <a href="https://github.com/iTimeTraveler/hexo-theme-hipaper" target="_blank">hipaper</a>
      </div>
  </div>
</footer>


<!-- min height -->

<script>
    var wrapdiv = document.getElementById("wrap");
    var contentdiv = document.getElementById("content");

    wrapdiv.style.minHeight = document.body.offsetHeight - document.getElementById("allheader").offsetHeight - document.getElementById("footer").offsetHeight + "px";
    contentdiv.style.minHeight = document.body.offsetHeight - document.getElementById("allheader").offsetHeight - document.getElementById("footer").offsetHeight + "px";


    <!-- headerblur min height -->
    
    
</script>

    
<div style="display: none;">
  <script src="https://s11.cnzz.com/z_stat.php?id=1260716016&web_id=1260716016" language="JavaScript"></script>
</div>

<!-- mathjax config similar to math.stackexchange -->

<script type="text/x-mathjax-config">
  MathJax.Hub.Config({
    tex2jax: {
      inlineMath: [ ['$','$'], ["\\(","\\)"] ],
      processEscapes: true
    }
  });
</script>

<script type="text/x-mathjax-config">
    MathJax.Hub.Config({
      tex2jax: {
        skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
      }
    });
</script>

<script type="text/x-mathjax-config">
    MathJax.Hub.Queue(function() {
        var all = MathJax.Hub.getAllJax(), i;
        for(i=0; i < all.length; i += 1) {
            all[i].SourceElement().parentNode.className += ' has-jax';
        }
    });
</script>

<script type="text/javascript" src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML">
</script>


  
<link rel="stylesheet" href="/fancybox/jquery.fancybox.css">

  
<script src="/fancybox/jquery.fancybox.pack.js"></script>




<script src="/js/script.js"></script>


<script src="/js/bootstrap.js"></script>


<script src="/js/main.js"></script>








  <div style="display: none;">
    <script src="https://s95.cnzz.com/z_stat.php?id=1260716016&web_id=1260716016" language="JavaScript"></script>
  </div>



	<script async src="//dn-lbstatics.qbox.me/busuanzi/2.3/busuanzi.pure.mini.js">
	</script>






  </div>

  <a id="rocket" href="#top" class=""></a>
  <script type="text/javascript" src="/js/totop.js" async=""></script>
</body>
</html>
